Update dependency homeassistant to v2023.12.3 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
homeassistant	==2023.8.0 -> ==2023.12.3

GitHub Vulnerability Alerts

CVE-2023-41893

Part of the Cure53 security audit of Home Assistant.

The audit team’s analyses confirmed that the redirect_uri and client_id are alterable when logging in. Consequently, the code parameter utilized to fetch the access_token post-authentication will be sent to the URL specified in the aforementioned parameters.

Since an arbitrary URL is permitted and homeassistant.local represents the preferred, default domain likely used and trusted by many users, an attacker could leverage this weakness to manipulate a user and retrieve account access. Notably, this attack strategy is plausible if the victim has exposed their Home Assistant to the Internet, since after acquiring the victim’s access_token, the adversary would need to utilize it directly towards the instance to achieve any pertinent malicious actions.

To achieve this compromise attempt, the attacker must send a link with a redirect_uri that they control to the victim’s own Home Assistant instance. In the eventuality the victim authenticates via the said link, the attacker would obtain code sent to the specified URL in redirect_uri, which can then be leveraged to fetch an access_token.

An attacker could increase the efficacy of this strategy by registering a nearly identical domain to homeassistant.local, which at first glance may appear legitimate and thereby obfuscate any malicious intentions.

Nonetheless, owing to the requirements for victim interaction and Home Assistant instance exposure to the Internet, this severity rating was consequently downgraded to Low.

CVE-2023-50715

Summary

The login page discloses all active user accounts to any unauthenticated browsing request originating on the Local Area Network.

Details

Starting the Home Assistant 2023.12 release, the login page returns all currently active user accounts to browsing requests from the Local Area Network. Tests showed that this occurs when:

• The request is not authenticated and
• The request originated locally, meaning on the Home Assistant host local subnet or any other private subnet (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, fd00::/8, ::ffff:10.0.0.0/104, ::ffff:172.16.0.0/108, ::ffff:192.168.0.0/112)

The rationale behind this is to make the login more user-friendly (see release blog post) and an experience better aligned with other applications that have multiple user-profiles.

However, as a result, all accounts are displayed regardless of them having logged in or not and for any device that navigates to the server. This disclosure is mitigated by the fact that it only occurs for requests originating from a LAN address. But note that this applies to the local subnet where Home Assistant resides and to any private subnet that can reach it.

PoC

1. Place a Home Assistant instance on a private subnet, i.e., 192.168.1.0/24.
2. Create a few users, let's say, three.
3. From any (or another) private subnet on the LAN, like 192.168.2.0/24, open an incognito browser window (to ensure that the browser has no cookies from Home Assistant and therefore is demonstrably unauthenticated) and navigate to the Home Assistant URL.
4. The login page will display all three users, including their profile photo.

Impact

The following CVSS string could be shaped to describe the overall impact of this issue:
AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

As seen, the Exploitability metrics are high, and the Impact metrics are low. This is fitting because the problem does not constitute a critical one, but at the same time, it is trivial to exploit. Still, since the mitigation can be so easily implemented in code to eliminate a typical case of information disclosure, it would certainly be worth pursuing.

---

Release Notes

home-assistant/core (homeassistant)

v2023.12.3

Compare Source

• Ensure platform setup for all AVM FRITZ!SmartHome devices (@​mib1185 - #​105515) (fritzbox docs)
• Update AEMET-OpenData to v0.4.7 (@​Noltari - #​105676) (aemet docs) (dependency)
• Fix restoring UniFi clients with old unique id (@​Kane610 - #​105691) (unifi docs)
• Bump zeroconf to 0.128.5 (@​bdraco - #​105694) (zeroconf docs) (dependency)
• Add missing rest_command reload service to services.yaml (@​jpbede - #​105714) (rest_command docs)
• Fix issue clearing renault schedules (@​epenet - #​105719) (renault docs) (dependency)
• Fix Fully Kiosk Browser MQTT event callbacks with non-standard event topics (@​cgarwood - #​105735) (fully_kiosk docs)
• Disable user profiles on login screen (@​frenck - #​105749) (auth docs) (person docs) (breaking-change)

v2023.12.2

Compare Source

• Fix Lyric LCC thermostats auto mode (@​apt-itude - #​104853) (lyric docs)
• Bump zeroconf to 0.128.0 (@​bdraco - #​104936) (zeroconf docs) (dependency)
• Fix CI test_invalid_rrule_fix test by freezing the time (@​jbouwh - #​105294) (google docs)
• Add missing configuration for services.yaml in blink (@​mkmer - #​105310) (blink docs)
• Bump pyschlage to 2023.12.0 (@​dknowles2 - #​105349) (schlage docs) (dependency)
• Fix preset modes error in Smartthings (@​gjohansson-ST - #​105375) (smartthings docs)
• Fix service missing key in Blink (@​mkmer - #​105387) (blink docs)
• Fix adding/updating todo items with due date in CalDAV integration (@​DerFlob - #​105435) (caldav docs)
• Check if heat area exists when setting up valve opening and battery sensors in moehlenhoff alpha2 (@​j-a-n - #​105437) (moehlenhoff_alpha2 docs)
• Bump hatasmota to 0.8.0 (@​emontnemery - #​105440) (tasmota docs)
• Bump plugwise to v0.35.3 (@​bouwew - #​105442) (plugwise docs) (dependency)
• Fix alexa calling not featured cover services (@​jbouwh - #​105444) (alexa docs)
• Fix fitbit oauth reauth debug logging (@​allenporter - #​105450) (fitbit docs)
• Write Enphase Envoy data to log when in debug mode (@​catsmanac - #​105456) (enphase_envoy docs)
• Bump ical to 6.1.1 (@​allenporter - #​105462) (local_calendar docs) (local_todo docs) (dependency)
• Bump zeroconf to 0.128.4 (@​bdraco - #​105465) (zeroconf docs) (dependency)
• Remove Aftership import issue when entry already exists (@​joostlek - #​105476) (aftership docs)
• Disconnect before reconnecting to satellite (@​synesthesiam - #​105500) (wyoming docs)
• Bump caldav to 1.3.8 (@​FrnchFrgg - #​105508) (caldav docs)
• Bump pyhiveapi to v0.5.16 (@​KJonline - #​105513) (hive docs) (dependency)
• Fix setup Fast.com (@​gjohansson-ST - #​105580) (fastdotcom docs)
• Add name slot to HassClimateGetTemperature intent (@​synesthesiam - #​105585) (climate docs)
• Skip TTS events entirely with empty text (@​synesthesiam - #​105617) (assist_pipeline docs)
• Rename "satellite enabled" to "mute" (@​synesthesiam - #​105619) (wyoming docs)
• Fix timing issue in Withings (@​joostlek - #​105203) (withings docs)
• Update pylint to 3.0.3 (@​cdce8p - #​105491) (mqtt docs) (zha docs) (improv_ble docs) (dependency)
• Reload ZHA integration on any error, not just recoverable ones (@​puddly - #​105659) (zha docs)
• Bump ZHA dependencies (@​puddly - #​105661) (zha docs) (dependency)

v2023.12.1

Compare Source

• Initialize energy_state without price (@​Excentyl - #​97031) (energy docs)
• Bump yolink-api to 0.3.4 (@​matrixd2 - #​105124) (yolink docs) (dependency)
• Bump apple_weatherkit to 1.1.2 (@​tjhorner - #​105140) (weatherkit docs) (dependency)
• Correct smtp error message string (@​jbouwh - #​105148) (smtp docs)
• Expose todo entities to Assist by default (@​synesthesiam - #​105150) (homeassistant docs)
• Disable scenarios (scenes) for local API in Overkiz (@​iMicknl - #​105153) (overkiz docs)
• Improve LIDL christmas light detection in deCONZ (@​Kane610 - #​105155) (deconz docs)
• Bump reolink_aio to 0.8.2 (@​starkillerOG - #​105157) (reolink docs) (dependency)
• Don't return TTS URL in Assist pipeline (@​synesthesiam - #​105164) (assist_pipeline docs)
• Bump Météo-France to 1.3.0 (@​Quentame - #​105170) (meteo_france docs) (dependency)
• Fix ZHA quirk ID custom entities matching all devices (@​TheJulianJES - #​105184) (zha docs)
• Fix missing apostrophe in smtp (@​lunmay - #​105189) (smtp docs)
• Set ping interval to 15 seconds instead of 5 minutes (@​nohn - #​105191) (ping docs)
• Increase ping update interval to 30 seconds (@​jpbede - #​105199) (ping docs)
• Fix bug in roon incremental volume control. (@​pavoni - #​105201) (roon docs)
• fix supportedFanOscillationModes is null (@​haimn - #​105205) (smartthings docs)
• Disable config flow progress in peco config flow (@​emontnemery - #​105222) (peco docs)
• Fix Fritzbox light setup (@​flabbamann - #​105232) (fritzbox docs)
• Fix check_date service in workday (@​gjohansson-ST - #​105241) (workday docs)
• Fix AsusWrt invalid data type with tuple type (@​ollo69 - #​105247) (asuswrt docs)
• Explicit check for None in Discovergy entity if condition (@​jpbede - #​105248) (discovergy docs)
• Add migration for old HomeWizard sensors (@​DCSBL - #​105251) (homewizard docs)
• Fix update of uncategorized OurGroceries items (@​OnFreund - #​105255) (ourgroceries docs)
• Bump pyunifiprotect to 4.22.0 (@​bdraco - #​105265) (unifiprotect docs) (dependency)
• Set device id and forward errors to Wyoming satellites (@​synesthesiam - #​105266) (wyoming docs)
• Fix mqtt json light state updates using deprecated color handling (@​jbouwh - #​105283) (mqtt docs)
• Always set _attr_current_option in Nobø Hub select entities (@​oyvindwe - #​105289) (nobo_hub docs)
• Update frontend to 2023120.2 (@​piitaya - #​105299) (frontend docs)
• Add test for energy cost sensor for late price sensor (@​emontnemery - #​105312) (energy docs)
• Use area id for context instead of name (@​synesthesiam - #​105313) (conversation docs)
• Add workaround for orjson not handling subclasses of str (@​emontnemery - #​105314)
• Add rollback on exception that needs rollback in SQL (@​gjohansson-ST - #​104948) (sql docs)
• Workaround to_json template filter in parsing dict key (@​jbouwh - #​105327)
• Bump plugwise to v0.34.5 (@​bouwew - #​105330) (plugwise docs) (dependency)

v2023.12.0

Compare Source

https://www.home-assistant.io/blog/2023/12/06/release-202312/

v2023.11.3

Compare Source

• Bump accuweather to version 2.0.1 (@​bieniu - #​103532) (accuweather docs) (dependency)
• Remove rainbird yaml config test fixtures (@​allenporter - #​103607) (rainbird docs)
• Lock Withings token refresh (@​joostlek - #​103688) (withings docs)
• Bump accuweather to version 2.1.0 (@​bieniu - #​103744) (accuweather docs) (dependency)
• Bump python-matter-server to 4.0.2 (@​bdraco - #​103760) (matter docs) (dependency)
• Bump subarulink to 0.7.9 (@​G-Two - #​103761) (subaru docs) (dependency)
• Fix discovery schema for Matter switches (@​marcelveldt - #​103762) (matter docs)
• Fix raising vol.Invalid during mqtt config validation instead of ValueError (@​jbouwh - #​103764) (mqtt docs)
• Fix race condition in Matter unsubscribe method (@​marcelveldt - #​103770) (matter docs)
• Fix typo in calendar translation (@​jrieger - #​103789) (calendar docs)
• Fix Rainbird unique to use a more reliable source (mac address) (@​allenporter - #​101603) (rainbird docs)
• Bump pyOverkiz to 1.13.0 (@​iMicknl - #​103582) (overkiz docs) (dependency)
• Bump pyOverkiz to 1.13.2 (@​iMicknl - #​103790) (overkiz docs) (dependency)
• Bump aiocomelit to 0.5.2 (@​chemelli74 - #​103791) (comelit docs) (dependency)
• Bump velbusaio to 2023.11.0 (@​Cereal2nd - #​103798) (velbus docs) (dependency)
• Bump pyunifiprotect to 4.21.0 (@​bdraco - #​103832) (unifiprotect docs) (dependency)
• Bump lupupy to 0.3.1 (@​suaveolent - #​103835) (lupusec docs) (dependency)
• Bump gcal_sync to 6.0.1 (@​allenporter - #​103861) (google docs) (dependency)
• Fix bug in Fitbit config flow, and switch to prefer display name (@​allenporter - #​103869) (fitbit docs)
• Fix for Google Calendar API returning invalid RRULE:DATE rules (@​allenporter - #​103870) (google docs)
• Update Fitbit to avoid a KeyError when restingHeartRate is not present (@​allenporter - #​103872) (fitbit docs)
• fix Comelit cover stop (@​chemelli74 - #​103911) (comelit docs)
• Fix Coinbase for new API Structure (@​TomBrien - #​103930) (coinbase docs)
• Bump zwave-js-server-python to 0.54.0 (@​raman325 - #​103943) (zwave_js docs) (dependency)
• Update smarttub to 0.0.36 (@​mdz - #​103948) (smarttub docs)
• Fix duplicate Ban file entries (@​fosterchuck - #​103953) (http docs)
• Fix openexchangerates form data description (@​MartinHjelmare - #​103974) (openexchangerates docs)
• Fix emulated_hue with None values (@​bdraco - #​104020) (emulated_hue docs)
• Fix netatmo authentication when using cloud authentication credentials (@​deosrc - #​104021) (netatmo docs)
• Fix device tracker see gps accuracy selector (@​MartinHjelmare - #​104022) (device_tracker docs)
• Bump pyenphase to 1.14.3 (@​catsmanac - #​104101) (enphase_envoy docs) (dependency)
• Fix ESPHome BLE client raising confusing error when not connected (@​bdraco - #​104146) (esphome docs)
• Fix memory leak in ESPHome disconnect callbacks (@​bdraco - #​104149) (esphome docs)
• Add debug logging for which adapter is used to connect bluetooth devices (@​bdraco - #​103264) (bluetooth docs)
• Prevent Bluetooth reconnects from blocking shutdown (@​bdraco - #​104150) (bluetooth docs)
• Bump boschshcpy to 0.2.75 (@​tschamm - #​104159) (bosch_shc docs)
• Fix Local To-do list bug renaming items (@​allenporter - #​104182) (local_todo docs)
• Bump aiosomecomfort to 0.0.22 (@​mkmer - #​104202) (honeywell docs)
• Increase Tomato request timeout (@​ertechdesign - #​104203) (tomato docs)
• Fix imap does not decode text body correctly (@​jbouwh - #​104217) (imap docs)
• Fix mqtt json light allows to set brightness value >255 (@​jbouwh - #​104220) (mqtt docs)
• Handle attributes set to None in prometheus (@​knyar - #​104247) (prometheus docs)
• Catch ClientOSError in renault integration (@​epenet - #​104248) (renault docs)
• Restore removed guard for non-string inputs in Alexa (@​jbouwh - #​104263) (alexa docs)
• Bump bimmer_connected to 0.14.3 (@​rikroe - #​104282) (bmw_connected_drive docs) (dependency)
• Bump pyrainbird to 4.0.1 (@​allenporter - #​104293) (rainbird docs) (dependency)
• Bump pychromecast to 13.0.8 (@​emontnemery - #​104320) (cast docs)
• Bump ical to 6.0.0 (@​allenporter - #​103482) (local_calendar docs) (local_todo docs) (dependency)
• Bump ical to 6.1.0 (@​allenporter - #​103759) (local_calendar docs) (local_todo docs) (dependency)

v2023.11.2

Compare Source

• Don't assume that the sleep value is a dictionary in Tractive integration (@​bieniu - #​103138) (tractive docs)
• Update aioairzone-cloud to v0.3.2 (@​Noltari - #​103258) (airzone_cloud docs) (dependency)
• Update aioairzone-cloud to v0.3.5 (@​Noltari - #​103315) (airzone_cloud docs) (dependency)
• Handle null data in WeatherFlow sensors (@​natekspencer - #​103349) (weatherflow docs)
• Handle smarttub sensor values being None (@​mdz - #​103385) (smarttub docs) (dependency)
• Pin jaraco.functools to fix builds and CI (@​bdraco - #​103406) (abode docs) (dependency)
• Update tailscale to 0.6.0 (@​frenck - #​103409) (tailscale docs) (dependency)
• Bump pyatmo to v7.6.0 (@​cgtobi - #​103410) (netatmo docs)
• Fix serial in Flo device information (@​mib1185 - #​103427) (flo docs)
• modbus Allow swap: byte for datatype: string. (@​janiversen - #​103441) (modbus docs)
• Modbus set device_class in slaves (@​janiversen - #​103442) (modbus docs)
• Fix KNX expose default value when attribute is None (@​farmio - #​103446) (knx docs)
• Sort Withings sleep data on end date (@​joostlek - #​103454) (withings docs)
• Use right equipment identifier in DSMR setup (@​dupondje - #​103494) (dsmr docs)
• Fix litterrobot test failure due to time zone dependence (@​mdz - #​103444) (litterrobot docs)
• Revert binary_sensor part of #​103210 (@​edenhaus - #​103499) (mqtt docs)
• ESPHome: Add suggested_area from device info (@​jesserockz - #​102834) (esphome docs)
• Bump aioesphomeapi to 18.2.1 (@​bdraco - #​103156) (esphome docs) (dependency)
• Bump bluetooth-data-tools to 0.14.0 (@​bdraco - #​103413) (esphome docs) (bluetooth docs) (led_ble docs) (ld2410_ble docs) (private_ble_device docs) (dependency)
• Bump blinkpy to 0.22.3 (@​mkmer - #​103438) (blink docs) (dependency)
• Fix 5B Gas meter in dsmr (@​dupondje - #​103506) (dsmr docs)
• Fix invalid MAC in samsungtv (@​epenet - #​103512) (samsungtv docs)
• Bump aioesphomeapi to 18.2.4 (@​bdraco - #​103552) (esphome docs) (dependency)
• Bump pyenphase to 1.14.2 (@​cgarwood - #​103553) (enphase_envoy docs) (dependency)
• Update dsmr-parser to 1.3.1 to fix parsing issues (@​dupondje - #​103572) (dsmr docs) (dependency)
• fix: get_devices only checks for the first type (@​suaveolent - #​103583) (lupusec docs)
• Raise exception when data can't be fetched in Opensky (@​joostlek - #​103596) (opensky docs)
• Bump yt-dlp to 2023.10.13 (@​joostlek - #​103616) (media_extractor docs) (dependency)
• Fix Reolink DHCP IP update (@​starkillerOG - #​103654) (reolink docs)
• Incease tplink setup timeout (@​bdraco - #​103671) (tplink docs)
• Add name to Withings coordinator (@​joostlek - #​103692) (withings docs)
• Update frontend to 2023103.2 (@​bramkragten - #​103706) (frontend docs)

v2023.11.1

Compare Source

• Bump python-holidays to 0.35 (@​gjohansson-ST - #​103092) (workday docs) (dependency)
• Bump aiowaqi to 3.0.0 (@​joostlek - #​103166) (waqi docs) (dependency)
• Catch unexpected response in Honeywell (@​mkmer - #​103169) (honeywell docs)
• Fix roomba translation key mismatch (@​Xitee1 - #​103191) (roomba docs)
• Fix roomba error if battery stats are not available (@​Xitee1 - #​103196) (roomba docs)
• Fix mqtt config validation error handling (@​jbouwh - #​103210) (mqtt docs)
• Fix Fronius entity initialisation (@​farmio - #​103211) (fronius docs)
• Bump pyenphase to 1.14.1 (@​cgarwood - #​103239) (enphase_envoy docs)
• Remove measurement flag from timestamp in gardena bluetooth (@​elupus - #​103245) (gardena_bluetooth docs)
• Fix Plugwise Schedule selection (@​CoMPaTech - #​103262) (plugwise docs)
• Bump yalexs-ble to 2.3.2 (@​bdraco - #​103267) (august docs) (yalexs_ble docs) (dependency)
• add library logger info on ecoforest integration manifest (@​pjanuario - #​103274) (ecoforest docs)
• Fix Matter 1.2 locks with specific unlatch/unbolt support (@​marcelveldt - #​103275) (matter docs)
• Fix firmware update failure (@​raman325 - #​103277) (zwave_js docs)
• Bump opower to 0.0.39 (@​tronikos - #​103292) (opower docs) (dependency)
• Bump reolink-aio to 0.7.14 and improve typing of Reolink (@​starkillerOG - #​103129) (reolink docs)
• Bump py_nextbusnext to v1.0.2 to fix TypeError (@​ViViDboarder - #​103214) (nextbus docs) (dependency)
• Add script to convert zwave_js device diagnostics to fixture (@​raman325 - #​102799) (zwave_js docs)
• Fix typo in Todoist config flow (@​jpbede - #​103317) (todoist docs)
• Remove extra from traccar webhook (@​ludeeus - #​103319) (traccar docs)
• Report correct weather condition at night for Met (@​jrieger - #​103334) (met docs)
• Handle UniFi traffic rules not supported on older versions (@​Kane610 - #​103346) (unifi docs)
• Fix sensor unique id in Islamic prayer times (@​engrbm87 - #​103356) (islamic_prayer_times docs)
• Fix zwave_js cover bug for Window Covering CC values (@​raman325 - #​103289) (zwave_js docs)

v2023.11.0

Compare Source

https://www.home-assistant.io/blog/2023/11/01/release-202311/

v2023.10.5

Compare Source

• Downgrade ZHA dependency bellows (@​puddly - #​102471) (zha docs)
• Bump async-upnp-client to 0.36.2 (@​StevenLooman - #​102472) (upnp docs) (yeelight docs) (dlna_dmr docs) (samsungtv docs) (ssdp docs) (dlna_dms docs) (dependency)

v2023.10.4

Compare Source

• Fix Spotify media position update value ([@​Archomeda] - [#​100044]) ([spotify docs])
• Fix error handling on subscribe when mqtt is not initialized (@​jbouwh - [#​101832]) (mqtt docs)
• Bump aioesphomeapi to 17.1.4 (@​bdraco - [#​101897]) (esphome docs) (dependency)
• Bump aioesphomeapi to 17.1.5 (@​bdraco - [#​101916]) (esphome docs) (

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.